Well it happened a while back, remember? The French researcher Guillaume Tena who got in trouble for breaching French copywrite laws by decompiling some software.
Now people are generally starting to worry about disclosing vulnerabilities through any channels, does there need to be some kind of anonymous PGP key based system for vulnerability disclosure? So people can do it without fear of getting sued?
The CERIAS weblog examines the risks associated with reporting vulnerabilities. In the end, he advises that the risks (in one situation, at least) were almost not worth the trouble, and gives advice on how to stay out of trouble. Is it worth it to report vulnerabilities despite the risks, or is the chilling effect demonstrated here too much?
A typical difficulty encountered by vulnerability researchers is that administrators or programmers often deny that a problem is exploitable or is of any consequence, and request a proof. This got Eric McCarty in trouble & the proof is automatically a proof that you breached the law, and can be used to prosecute you!
It’s an interesting point when it comes to public disclosure, unless you have permission, how do you prove you’ve found a vulnerability without getting in trouble?
HD Moore also discussed this recently with:
- Sony Pictures Hacked – Employee Details & Movies Leaked
- Gruyere – Learn Web Application Exploits & Defenses
- Critical XSS Flaw Affects WordPress 3.9.2 And Earlier
- 3Com’s TippingPoint Finds New IE Vulnerabilities
- What Responsibility do Anti-Spyware Researchers Have?
- Sandcat by Syhunt – Web Server & Application Vulnerability Scanner
Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 228,490 views
- AJAX: Is your application secure enough? - 119,243 views
- eEye Launches 0-Day Exploit Tracker - 85,118 views